$ show Curbob/LobsterBoard
LobsterBoard is a self-hosted, drag-and-drop dashboard builder implemented as a monolithic Node.js server with a vanilla JavaScript frontend. It provides real-time system monitoring via SSE, 50+ configurable widgets (weather, finance, AI usage, system stats, etc.), a template gallery, custom pages with server-side APIs, and remote server management with ECDH-encrypted polling. The server handles authentication (password/PIN/public mode), secrets management, proxy with SSRF protection, and AI provider integrations. The frontend consists of modular editor components (canvas, drag-drop, properties, export) and a widget library using a simple generateHtml/generateJs pattern. The architecture is straightforward but lacks modern framework abstractions, has some code duplication between source and legacy files, and uses eval for widget JS generation, posing potential security risks. The project is actively maintained (recent commits, CHANGELOG) but shows signs of technical drift: dated JavaScript patterns (var, IIFEs), manual DOM manipulation, and a BSL license that restricts commercial use.
The LLM identified 4 files worth highlighting for reuse:
Implements ECDH key exchange for encrypting communication between the LobsterBoard server and remote agents. It generates key pairs, computes shared secrets, and encrypts/decrypts messages using AES-256-GCM. This module is self-contained, has no internal dependencies beyond Node.js crypto, and could be extracted into other projects requiring secure symmetric key exchange over an untrusted channel.
Provides a configurable HTTP/HTTPS proxy with built-in SSRF protection. It validates target URLs against a private IP blocklist (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.) and rejects requests to localhost or loopback addresses. The proxy supports custom headers (e.g., User-Agent) and passes through credentials. This pattern is directly reusable in any Node.js application that needs to proxy external requests while preventing server-side request forgery.
Extracts sensitive configuration properties (API keys, tokens, passwords) from a dashboard config object and stores them in a separate server-side secrets.json file. It provides a maskConfig() function that replaces sensitive values with '••••••••' in API responses, ensuring secrets are never sent to the browser. The list of sensitive keys is configurable. This module is self-contained and can be reused in any application that needs to separate secrets from configuration while maintaining a masked view for clients.
Exposes two global helper functions: _esc (HTML-escapes a string to prevent XSS) and _isSafeUrl (validates URLs against allowed protocols and rejects javascript: URIs). These are used by all widget generateJs functions to sanitize user-provided data. The functions are simple, well-tested patterns for frontend security, and can be extracted into any JavaScript project that needs to safely render user input.